@highflame/policy 2.1.1 → 2.1.3

package/_schemas/guardrails/schema.cedarschema

@@ -126,15 +126,63 @@ namespace Guardrails {
         "contains_invisible_chars"?: Bool,
         "invisible_chars_score"?: Long,      // 0-100
 
-        // Additional detectors (optional)
+        // Security - Pattern Detection (optional)
+        "command_injection_detected"?: Bool,
+        "command_injection_type"?: String,       // "reverse_shell" | "privilege_escalation" | "code_execution" | "destructive_command" | "data_exfiltration"
+        "command_injection_score"?: Long,        // 0-100
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,      // "critical" | "high" | "medium" | "low" | "none"
+        "path_traversal_type"?: String,
+        "sql_injection_detected"?: Bool,
+        "sql_injection_type"?: String,           // "tautology" | "union_based" | "destructive" | "blind" | "error_based"
+        "sql_injection_score"?: Long,            // 0-100
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Bool,
+        "cross_origin_type"?: String,            // "cross_origin_tool" | "cross_origin_server" | "none"
+        "cross_origin_score"?: Long,             // 0-100
+
+        // Security - Encoded Injection (optional)
+        "encoded_content_detected"?: Bool,
+        "encoded_types"?: Set<String>,           // ["base64", "hex", "unicode", "url", ...]
+        "encoded_count"?: Long,
+        "encoded_score"?: Long,                  // 0-100
+
+        // Language & Script Detection (optional)
+        "detected_language"?: String,            // ISO language code
+        "is_english"?: Bool,
+        "language_confidence"?: Long,            // 0-100
+        "detected_script"?: String,              // "latin" | "cyrillic" | "arabic" | "unknown" | ...
+        "is_latin_script"?: Bool,
+        "script_confidence"?: Long,              // 0-100
+
+        // Content Analysis (optional)
         "hallucination_score"?: Long,
+        "factuality_score"?: Long,               // 0-100
         "sentiment_score"?: Long,
         "contains_code"?: Bool,
         "code_languages"?: Set<String>,
+        "code_ratio"?: Long,                     // 0-100, percentage of content that is code
         "keyword_matched"?: Bool,
         "keyword_categories"?: Set<String>,
-        "detected_language"?: String,
+        "keyword_count"?: Long,
+        "contains_non_ascii"?: Bool,
         "phishing_detected"?: Bool,
+        "content_safety_score"?: Long,           // 0-100
+        "content_safety_blocked"?: Bool,
+
+        // Agentic - Multi-Turn Context (optional)
+        "conversation_turn"?: Long,
+        "multi_turn_detection"?: Bool,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
 
     };
 
@@ -181,6 +229,54 @@ namespace Guardrails {
         "pii_types"?: Set<String>,
         "injection_score"?: Long,
 
+        // Security - Pattern Detection (optional)
+        "command_injection_detected"?: Bool,
+        "command_injection_type"?: String,
+        "command_injection_score"?: Long,        // 0-100
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+        "sql_injection_detected"?: Bool,
+        "sql_injection_type"?: String,
+        "sql_injection_score"?: Long,            // 0-100
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Bool,
+        "cross_origin_type"?: String,
+        "cross_origin_score"?: Long,             // 0-100
+
+        // Security - Encoded Injection (optional)
+        "encoded_content_detected"?: Bool,
+        "encoded_types"?: Set<String>,
+        "encoded_count"?: Long,
+        "encoded_score"?: Long,                  // 0-100
+
+        // Agentic - Agent Security (optional)
+        "tool_poisoning_detected"?: Bool,
+        "tool_poisoning_score"?: Long,           // 0-100
+        "tool_poisoning_type"?: String,          // "hidden_instructions" | "system_prompt_injection" | "authority_hijack"
+        "rug_pull_detected"?: Bool,
+        "rug_pull_score"?: Long,                 // 0-100
+        "rug_pull_type"?: String,                // "risk_spike" | "pattern_change" | "combined" | "none"
+
+        // Agentic - MCP Risk (optional)
+        "mcp_config_risk"?: Bool,
+        "mcp_risk_type"?: String,                // "inline_execution" | "suspicious_url" | "cross_origin"
+        "mcp_risk_score"?: Long,                 // 0-100
+
+        // Agentic - Multi-Turn Context (optional)
+        "conversation_turn"?: Long,
+        "multi_turn_detection"?: Bool,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 
     /// Context for read_file action
@@ -195,6 +291,20 @@ namespace Guardrails {
         "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
+        // Security - Path Traversal (optional)
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 
     /// Context for write_file action
@@ -209,6 +319,20 @@ namespace Guardrails {
         "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
+        // Security - Path Traversal (optional)
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 
     /// Context for connect_server action (MCP server connections)
@@ -221,5 +345,29 @@ namespace Guardrails {
         "mcp_server"?: String,           // MCP server name (e.g., "github", "filesystem")
         "mcp_server_verified"?: Bool,    // Whether server is from verified registry
 
+        // Agentic - Agent Security (optional)
+        "tool_poisoning_detected"?: Bool,
+        "tool_poisoning_score"?: Long,
+        "tool_poisoning_type"?: String,
+
+        // Agentic - MCP Risk (optional)
+        "mcp_config_risk"?: Bool,
+        "mcp_risk_type"?: String,
+        "mcp_risk_score"?: Long,
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Bool,
+        "cross_origin_type"?: String,
+        "cross_origin_score"?: Long,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 }

package/_schemas/guardrails/templates/defaults/agentic_safety.cedar

@@ -92,3 +92,48 @@ forbid (
     context.budget_remaining_pct < 5 &&
     context.budget_remaining_pct > 0
 };
+
+// =============================================================================
+// Agent Security — Supply Chain & Behavioral Drift
+// =============================================================================
+
+@id("agentic-block-tool-poisoning")
+@name("Block tool poisoning attacks")
+@description("Forbids tool calls or server connections when hidden instructions or authority hijack patterns are detected in tool descriptions or arguments")
+@severity("critical")
+@tags("agentic,tool-poisoning,supply-chain")
+forbid (
+    principal,
+    action in [Guardrails::Action::"call_tool", Guardrails::Action::"connect_server"],
+    resource
+) when {
+    context has tool_poisoning_score && context.tool_poisoning_score >= 70
+};
+
+@id("agentic-block-rug-pull")
+@name("Block rug pull attacks")
+@description("Forbids tool calls when significant behavioral drift is detected (tool output deviates from established patterns)")
+@severity("high")
+@tags("agentic,rug-pull,behavioral-drift")
+forbid (
+    principal,
+    action == Guardrails::Action::"call_tool",
+    resource
+) when {
+    context has rug_pull_detected && context.rug_pull_detected == true &&
+    context has rug_pull_score && context.rug_pull_score >= 70
+};
+
+@id("agentic-block-mcp-config-risk")
+@name("Block risky MCP configurations")
+@description("Forbids tool calls or server connections when MCP configuration risks are detected (inline execution, suspicious URLs, cross-origin issues)")
+@severity("high")
+@tags("agentic,mcp-risk,supply-chain")
+forbid (
+    principal,
+    action in [Guardrails::Action::"call_tool", Guardrails::Action::"connect_server"],
+    resource
+) when {
+    context has mcp_config_risk && context.mcp_config_risk == true &&
+    context has mcp_risk_score && context.mcp_risk_score >= 70
+};

package/_schemas/guardrails/templates/defaults/security_patterns.cedar

@@ -0,0 +1,59 @@
+// =============================================================================
+// Security Pattern Detection Policy
+// =============================================================================
+// Blocks command injection, path traversal, and SQL injection attacks using
+// regex-based pattern detection from Shield's security detectors.
+//
+// Context keys used (normalized by projection layer):
+// - command_injection_detected: Bool - Command injection pattern found
+// - command_injection_score: Long (0-100) - Detection confidence
+// - path_traversal_detected: Bool - Path traversal pattern found
+// - path_traversal_severity: String - Severity level (critical/high/medium/low)
+// - sql_injection_detected: Bool - SQL injection pattern found
+// - sql_injection_score: Long (0-100) - Detection confidence
+//
+// Category: security
+// Namespace: Guardrails
+// =============================================================================
+
+@id("security-block-command-injection")
+@name("Block command injection")
+@description("Forbids requests containing command injection patterns such as reverse shells, privilege escalation, or destructive commands")
+@severity("critical")
+@tags("command-injection,security")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    resource
+) when {
+    context has command_injection_detected && context.command_injection_detected == true
+};
+
+@id("security-block-path-traversal")
+@name("Block high-severity path traversal")
+@description("Forbids requests containing path traversal patterns targeting sensitive system files or using deep directory traversal")
+@severity("high")
+@tags("path-traversal,security")
+forbid (
+    principal,
+    action,
+    resource
+) when {
+    context has path_traversal_detected && context.path_traversal_detected == true &&
+    context has path_traversal_severity &&
+    (context.path_traversal_severity == "critical" || context.path_traversal_severity == "high")
+};
+
+@id("security-block-sql-injection")
+@name("Block high-confidence SQL injection")
+@description("Forbids requests with SQL injection confidence above 75% (tautologies, UNION-based, destructive queries)")
+@severity("high")
+@tags("sql-injection,security")
+forbid (
+    principal,
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    resource
+) when {
+    context has sql_injection_detected && context.sql_injection_detected == true &&
+    context has sql_injection_score && context.sql_injection_score >= 75
+};

package/_schemas/guardrails/templates/templates.json

@@ -93,11 +93,21 @@
     {
       "id": "agentic-safety-default",
       "name": "Agentic Safety",
-      "description": "Block tool call loops, data exfiltration patterns, high-risk sequences, and budget violations",
+      "description": "Block tool call loops, data exfiltration patterns, high-risk sequences, budget violations, tool poisoning, rug pull attacks, and MCP configuration risks",
       "category": "agentic_security",
       "file": "defaults/agentic_safety.cedar",
       "severity": "high",
-      "tags": ["agentic", "safety", "loops", "exfiltration", "budget"],
+      "tags": ["agentic", "safety", "loops", "exfiltration", "budget", "tool-poisoning", "rug-pull", "mcp-risk"],
+      "is_active": true
+    },
+    {
+      "id": "security-patterns-default",
+      "name": "Security Pattern Detection",
+      "description": "Block command injection, path traversal, and SQL injection attacks using regex-based pattern detection",
+      "category": "security",
+      "file": "defaults/security_patterns.cedar",
+      "severity": "critical",
+      "tags": ["command-injection", "path-traversal", "sql-injection", "security"],
       "is_active": true
     }
   ],